SQL String Escaper
Escapes text as a SQL string literal for standard SQL or MySQL quoting rules.
Loading the tool…
Processing happens locally in your browser.
What you paste or load is processed by this page and is not uploaded to a server. Nothing is stored unless you use a control that says it stores something, and you can clear anything this site has kept from the privacy page.
How to use this tool
- Paste the text you need inside a string literal.
- Choose standard SQL or MySQL quoting rules.
- Select Escape — and use bound parameters instead if this is going into application code.
What sql string escaper does
A SQL string literal is wrapped in single quotes, and any single quote inside it is doubled. MySQL additionally treats the backslash as an escape character by default, so it needs one more rule. This applies whichever set you pick and shows you the finished literal.
Escaping by hand belongs in one-off scripts and nowhere else. In application code, use bound parameters: the value never becomes part of the statement text, so there is no escaping to get wrong and no injection to defend against. Any advice that begins "escape the input first" is describing a weaker approach than the one your database driver already gives you.
Frequently asked questions
Not reliably, and it is the wrong tool for the job. Bound parameters keep the value out of the statement text entirely, so there is nothing to escape and nothing to get wrong. Use this for one-off scripts, not for application code.
MySQL treats the backslash as an escape character inside string literals by default, which standard SQL does not. A value containing a backslash therefore needs it doubled for MySQL and left alone elsewhere.
They are kept as literal characters inside the quoted string, which is valid in every dialect this covers. If you need them as escape sequences, your driver or a dollar-quoted literal is the better route.